Browse CVEs by Ecosystem and Severity
870 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
HIGH
CVE-2026-34221
MikroORM has Prototype Pollution in Utils.merge
CRITICAL
CVE-2026-34220
MikroORM is vulnerable to SQL Injection via specially crafted object
HIGH
CVE-2026-35669
OpenClaw: Gateway Plugin HTTP Auth Grants Unrestricted operator.admin Runtime Scope to All Callers
CRITICAL
CVE-2026-35625
OpenClaw: Silent privilege escalation via gateway shared-auth reconnect
CRITICAL
CVE-2026-35663
OpenClaw: Gateway Backend Reconnect lets Non-Admin Operator Scopes Self-Claim operator.admin
CRITICAL
CVE-2026-33937
Handlebars.js has JavaScript Injection via AST Type Confusion
HIGH
CVE-2026-33943
Happy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable code
CRITICAL
CVE-2026-35639
OpenClaw Gateway: RCE and Privilege Escalation from operator.pairing to operator.admin via device.pair.approve
HIGH
CVE-2026-35643
OpenClaw: Arbitrary code execution via unvalidated WebView JavascriptInterface
HIGH
CVE-2026-35666
OpenClaw's system.run allowlist can be bypassed through an unregistered time dispatch wrapper
CRITICAL
CVE-2026-33864
Convict has Prototype Pollution via startsWith() function
CRITICAL
CVE-2026-33863
Convict has prototype pollution via load(), loadFile(), and schema initialization
MEDIUM
CVE-2026-33749
n8n Vulnerable to XSS via Binary Data Inline HTML Rendering
HIGH
CVE-2026-33713
n8n has SQL Injection in Data Table Node via orderByColumn Expression
CRITICAL
CVE-2026-33696
n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE
HIGH
CVE-2026-33663
n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition
CRITICAL
CVE-2026-33660
n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
CRITICAL
CVE-2026-26832
node-tesseract-ocr is vulnerable to OS Command Injection through unsanitized recognize() function parameter
CRITICAL
CVE-2026-26831
textract is vulnerable to OS Command Injection
CRITICAL
CVE-2026-26833
thumbler allows OS Command Injection
CRITICAL
CVE-2026-26830
pdf-image has an OS Command Injection Vulnerability through its pdfFilePath parameter
CRITICAL
CVE-2026-4599
jsrsasign: Incomplete Comparison Allows DSA Private Key Recovery via Biased Nonce Generation
HIGH
CVE-2026-4601
jsrsasign: Missing cryptographic validation during DSA signing enables private key extraction
HIGH
CVE-2026-33409
Parse Server has an auth provider validation bypass on login via partial authData
HIGH
CVE-2026-33228
Prototype Pollution via parse() in NodeJS flatted
HIGH
CVE-2026-33226
Budibase Unrestricted Server-Side Request Forgery (SSRF) via REST Datasource Query Preview
CRITICAL
CVE-2026-32731
ApostropheCMS has Arbitrary File Write (Zip Slip / Path Traversal) in Import-Export Gzip Extraction
CRITICAL
CVE-2026-31938
jsPDF has HTML Injection in New Window paths
HIGH
CVE-2026-32917
OpneClaw accepts unsanitized iMessage attachment paths which allowed SCP remote-path command injection
HIGH
CVE-2026-4092
@google/clasp vulnerable to unsafe path traversal cloning or pulling a malicious script
HIGH
CVE-2026-32635
Angular vulnerable to XSS in i18n attribute bindings
HIGH
CVE-2026-33573
OpenClaw: Gateway `agent` calls could override the workspace boundary
CRITICAL
CVE-2026-22172
OpenClaw: WebSocket shared-auth connections could self-declare elevated scopes
HIGH
CVE-2026-32914
OpenClaw: Command-authorized non-owners could reach owner-only `/config` and `/debug` surfaces
CRITICAL
CVE-2026-32621
Apollo Federation vulnerable to prototype pollution via incomplete key sanitization
CRITICAL
CVE-2026-32306
OneUptime ClickHouse SQL Injection via Aggregate Query Parameters
CRITICAL
CVE-2026-32304
Locutus vulnerable to RCE via unsanitized input in create_function()
HIGH
CVE-2026-32915
OpenClaw: Leaf subagents could steer sibling sessions across sandbox boundaries
CRITICAL
CVE-2026-32922
OpenClaw: Pairing-scoped device tokens could mint `operator.admin` and reach node RCE
CRITICAL
CVE-2026-32916
OpenClaw: Plugin subagent routes could bypass gateway authorization with synthetic admin scopes
CRITICAL
CVE-2026-26954
SandboxJS affected by a Sandbox Escape
CRITICAL
CVE-2026-28792
TinaCMS CLI Dev Server Vulnerable to Cross-Origin File Exfiltration via CORS Misconfiguration + Path Traversal in TinaCMS
CRITICAL
CVE-2026-32248
Parse Server: Account takeover via operator injection in authentication data identifier
MEDIUM
CVE-2026-73426
Trix has a Stored XSS vulnerability through serialized attributes
HIGH
CVE-2026-31975
@siteboon/claude-code-ui Vulnerable to Unauthenticated RCE via WebSocket Shell Injection
CRITICAL
CVE-2026-31871
Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
MEDIUM
CVE-2026-31868
Parse Server vulnerable to stored XSS via file upload of HTML-renderable file types
CRITICAL
CVE-2026-31856
Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
CRITICAL
CVE-2026-31862
@siteboon/claude-code-ui is Vulnerable to Command Injection via Multiple Parameters
HIGH
CVE-2026-31800
Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes